trace the source of a ZUC infection.

you cannot use the last modification dates in the Disinfectant report to

ZUC does not change the last modification date when it infects a file, so



damage.

Except for the unusual cursor behavior, ZUC does not attempt to do any



and from servers to individual Macintoshes.

ZUC can spread over a network from individual Macintoshes to servers



activity when infected applications are opened.

sometimes cause long delays and an unusually large amount of disk

strains can cause the desktop pattern to change. All three strains can also

ZUC has two noticeable side effects. On some Macintoshes, the A and B



virus. ZUC does spread and it is a virus.

should not be confused. The desk accessory does not spread and it is not a

named “Bouncy.” The virus and the desk accessory are different and they

The behavior of the ZUC virus is similar to that of a desk accessory



an infected application is run.

behave unusually approximately 67 seconds rather than 90 seconds after

not earlier than August 13, 1990, and ZUC C causes the cursor to begin to

period between 13 and 26 days after an application becomes infected, but

that ZUC C was timed to cause the unusual cursor behavior only during the

ZUC C is very similar to ZUC A and B. The only significant differences are



the screen. The cursor stops moving when the mouse button is released.

bouncing like a billiard ball whenever it reaches any of the four sides of

cursor moves diagonally across the screen, changing direction and

begins to behave unusually whenever the mouse button is held down. The

approximately 90 seconds after an infected application is run, the cursor

they only spread from application to application. After that date,

an application becomes infected, whichever is later. Before that date,

ZUC A and B were timed to activate on March 2, 1990 or two weeks after



files. Applications do not have to be run to become infected.

ZUC only infects applications. It does not infect system files or document



1990, ZUC B in November, 1990, and ZUC C in June, 1991.

the first strain, Don Ernesto Zucchini. ZUC A was discovered in March

discovered in Italy. The virus is named after the reported discoverer of

There are three known strains of the ZUC virus. All of them were




xThe ZUC Virus